Analysis

  • max time kernel
    145s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 15:29

General

  • Target

    3c2d424eb0ce7247e886445f3bee74414d0c3c61b5a47214d8bff84cfe31b3f7.exe

  • Size

    929KB

  • MD5

    8ec79a42d4b0f2035403361b5da3e882

  • SHA1

    61a7cb22e4e81d514fd6afa5dbf6ea9a7a61dfe5

  • SHA256

    3c2d424eb0ce7247e886445f3bee74414d0c3c61b5a47214d8bff84cfe31b3f7

  • SHA512

    e9e88fb8c4e3672b2228f6711939d3d6421caa6a24196513503300ad1a71a222ac56605eab367614b8b7352bc5a17265af441c3416b14fea5df3e98f6413dc70

  • SSDEEP

    12288:HMrSy90HaYq8+S8OUSKnnfB2HTXTAXsPNbLeFBtEA4jcSl2AZHZtCymuMjCRMR8H:5ybVvSdKfBeDTnPBeFml2AdZIyRGc

Malware Config

Extracted

Family

redline

Botnet

kendo

C2

77.91.124.82:19071

Attributes
  • auth_value

    5a22a881561d49941415902859b51f14

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c2d424eb0ce7247e886445f3bee74414d0c3c61b5a47214d8bff84cfe31b3f7.exe
    "C:\Users\Admin\AppData\Local\Temp\3c2d424eb0ce7247e886445f3bee74414d0c3c61b5a47214d8bff84cfe31b3f7.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5481510.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5481510.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5513708.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5513708.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4664
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x8841231.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x8841231.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1236
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3069819.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3069819.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:456
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:264
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 540
                  7⤵
                  • Program crash
                  PID:4044
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 552
                6⤵
                • Program crash
                PID:2808
            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h9166805.exe
              C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h9166805.exe
              5⤵
              • Executes dropped EXE
              PID:1284
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 264 -ip 264
      1⤵
        PID:3640
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 456 -ip 456
        1⤵
          PID:3920

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5481510.exe

                Filesize

                827KB

                MD5

                6802338ca60a7809c04c84ecaa88faf4

                SHA1

                c8d7481b96a8a331ee4c8e2a0883d063400ce0ba

                SHA256

                e6677eb1a32a02fd8e4331fad5c01448b355d32c8d62bba3b15250cfbd6a1fa7

                SHA512

                b63d326e013a6d3e2525e7e26f624566c9aadafd6384f9acda7f72dff08d143ec0927f4179895ae0b9ca046606e44cc60bed53a894c2fb570964af43a5c5bcd3

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5481510.exe

                Filesize

                827KB

                MD5

                6802338ca60a7809c04c84ecaa88faf4

                SHA1

                c8d7481b96a8a331ee4c8e2a0883d063400ce0ba

                SHA256

                e6677eb1a32a02fd8e4331fad5c01448b355d32c8d62bba3b15250cfbd6a1fa7

                SHA512

                b63d326e013a6d3e2525e7e26f624566c9aadafd6384f9acda7f72dff08d143ec0927f4179895ae0b9ca046606e44cc60bed53a894c2fb570964af43a5c5bcd3

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5513708.exe

                Filesize

                556KB

                MD5

                b31b4a948a2b398f52056dac828782d4

                SHA1

                3f9f95939081a6e10c2e7f066baca46caa9b698c

                SHA256

                6d77a77a0e19f276e4c9d6c483dc03c1bca471b0e3de8a783207cd7c17d595c2

                SHA512

                0f44793b53106ce56d3432ff461e43dc28e3240174f8cd4ae5e41b96da54a32db9b87783657a9b0da708531ef3d9bf4d90bb34833e76cb6902d6600a73784f93

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5513708.exe

                Filesize

                556KB

                MD5

                b31b4a948a2b398f52056dac828782d4

                SHA1

                3f9f95939081a6e10c2e7f066baca46caa9b698c

                SHA256

                6d77a77a0e19f276e4c9d6c483dc03c1bca471b0e3de8a783207cd7c17d595c2

                SHA512

                0f44793b53106ce56d3432ff461e43dc28e3240174f8cd4ae5e41b96da54a32db9b87783657a9b0da708531ef3d9bf4d90bb34833e76cb6902d6600a73784f93

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x8841231.exe

                Filesize

                390KB

                MD5

                d326ee5e5ec1b1eafaa788a43a18721d

                SHA1

                baa35b3d1ed53c625ddd8e80f55ce0e740d3e934

                SHA256

                e17a20c93754a7d74155c0326785af6ed2f4e194bba6c7e1f18f2ae9cc280ce6

                SHA512

                bfb00503961875dfd5272221e37aaf6494fd04528593bceab64157fbb240849db1a68619b403bbeb78b9eed76329a7ab7e7337624f9c3fd86718ccb47f0e3dc6

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x8841231.exe

                Filesize

                390KB

                MD5

                d326ee5e5ec1b1eafaa788a43a18721d

                SHA1

                baa35b3d1ed53c625ddd8e80f55ce0e740d3e934

                SHA256

                e17a20c93754a7d74155c0326785af6ed2f4e194bba6c7e1f18f2ae9cc280ce6

                SHA512

                bfb00503961875dfd5272221e37aaf6494fd04528593bceab64157fbb240849db1a68619b403bbeb78b9eed76329a7ab7e7337624f9c3fd86718ccb47f0e3dc6

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3069819.exe

                Filesize

                364KB

                MD5

                0cac19a90e4495a941516c4d463afb0d

                SHA1

                657430e558923c3abc5afa6d8e3396fd12c0b582

                SHA256

                415f80d4824b985faf2f33a865e59280c0c13e8b5fa9e3e66b53b279261dd6e0

                SHA512

                a32983466c3d799a2426ea527a9172c0c9e824059d296ea1dfda9273e9f9285484b5f62461398407a57ff7e2369156b03bed0047ae257c2ffd1ea6027cf64bfb

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3069819.exe

                Filesize

                364KB

                MD5

                0cac19a90e4495a941516c4d463afb0d

                SHA1

                657430e558923c3abc5afa6d8e3396fd12c0b582

                SHA256

                415f80d4824b985faf2f33a865e59280c0c13e8b5fa9e3e66b53b279261dd6e0

                SHA512

                a32983466c3d799a2426ea527a9172c0c9e824059d296ea1dfda9273e9f9285484b5f62461398407a57ff7e2369156b03bed0047ae257c2ffd1ea6027cf64bfb

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h9166805.exe

                Filesize

                174KB

                MD5

                4510646db9569fbb1ed02ca9b0c57218

                SHA1

                15aaa76b732d2a79960820c1c07c124bb278df2c

                SHA256

                c3aaa67faac5f8bd367aabfbe695ca20b9b94cfbcf9c34c6bd05d557d2c5bf3c

                SHA512

                29bc344f736696822d7f9b84fc8c93e9e75c1009a1acd941e188ea113204c1615a91808486698212bdf2ca0c312791e24830d18e7244bf8233011c3d0163bd7e

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h9166805.exe

                Filesize

                174KB

                MD5

                4510646db9569fbb1ed02ca9b0c57218

                SHA1

                15aaa76b732d2a79960820c1c07c124bb278df2c

                SHA256

                c3aaa67faac5f8bd367aabfbe695ca20b9b94cfbcf9c34c6bd05d557d2c5bf3c

                SHA512

                29bc344f736696822d7f9b84fc8c93e9e75c1009a1acd941e188ea113204c1615a91808486698212bdf2ca0c312791e24830d18e7244bf8233011c3d0163bd7e

              • memory/264-29-0x0000000000400000-0x0000000000428000-memory.dmp

                Filesize

                160KB

              • memory/264-30-0x0000000000400000-0x0000000000428000-memory.dmp

                Filesize

                160KB

              • memory/264-32-0x0000000000400000-0x0000000000428000-memory.dmp

                Filesize

                160KB

              • memory/264-28-0x0000000000400000-0x0000000000428000-memory.dmp

                Filesize

                160KB

              • memory/1284-39-0x000000000AB10000-0x000000000B128000-memory.dmp

                Filesize

                6.1MB

              • memory/1284-37-0x0000000074720000-0x0000000074ED0000-memory.dmp

                Filesize

                7.7MB

              • memory/1284-38-0x0000000005100000-0x0000000005106000-memory.dmp

                Filesize

                24KB

              • memory/1284-36-0x00000000006E0000-0x0000000000710000-memory.dmp

                Filesize

                192KB

              • memory/1284-40-0x000000000A690000-0x000000000A79A000-memory.dmp

                Filesize

                1.0MB

              • memory/1284-41-0x0000000005110000-0x0000000005120000-memory.dmp

                Filesize

                64KB

              • memory/1284-42-0x000000000A5D0000-0x000000000A5E2000-memory.dmp

                Filesize

                72KB

              • memory/1284-43-0x000000000A630000-0x000000000A66C000-memory.dmp

                Filesize

                240KB

              • memory/1284-44-0x000000000A7A0000-0x000000000A7EC000-memory.dmp

                Filesize

                304KB

              • memory/1284-45-0x0000000074720000-0x0000000074ED0000-memory.dmp

                Filesize

                7.7MB

              • memory/1284-46-0x0000000005110000-0x0000000005120000-memory.dmp

                Filesize

                64KB